redforge-sec 0.2.0__py3-none-any.whl

redforge/__init__.py

@@ -0,0 +1,9 @@
+"""RedForge — Security Operations Platform.
+
+A legitimate offensive + defensive security platform: penetration testing,
+vulnerability assessment, red-team automation, bug-bounty tooling, compliance
+auditing, and defensive monitoring. Scope is strictly limited to assets the
+user owns or is explicitly authorized to test.
+"""
+
+__version__ = "0.2.0"

redforge/cli.py

@@ -0,0 +1,512 @@
+#!/usr/bin/env python3
+"""RedForge command-line interface.
+
+Usage:
+    redforge recon subdomains <domain> --scope scope.json
+    redforge recon headers <url> --scope scope.json
+    redforge recon ports <host> --scope scope.json
+    redforge vuln cve <name>
+    redforge vuln config <file>
+    redforge vuln tls <host>
+    redforge compliance cis
+    redforge compliance password <password>
+    redforge defense logs <file>
+    redforge defense ioc <text>
+    redforge report <target> --scope scope.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from .core.config import Config
+from .core.report import build_markdown_report, write_report
+from .core.store import Store
+
+
+def _clean_output(findings: list, target: str, tool: str) -> list:
+    """Attach target/tool and drop internal keys for display."""
+    out = []
+    for f in findings:
+        f = dict(f)
+        f.setdefault("target", target)
+        f.setdefault("tool", tool)
+        out.append(f)
+    return out
+
+
+def cmd_recon(args, cfg: Config):
+    tool = args.sub
+    if tool == "subdomains":
+        from .recon import enum_subdomains, resolve_subdomains
+        cfg.scope.require(args.domain)
+        subs = enum_subdomains(args.domain)
+        print(f"Found {len(subs)} subdomains for {args.domain}")
+        for s in subs:
+            print("  " + s)
+        if args.resolve:
+            resolved = resolve_subdomains(subs)
+            for r in resolved:
+                print(f"    → {r['host']} = {r['ip']}")
+    elif tool == "headers":
+        from .recon import scan_headers
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc
+        cfg.scope.require(host)
+        findings = _clean_output(scan_headers(args.url), host, "header-scan")
+        _print_findings(findings)
+        if args.save and cfg.db_path:
+            _save(args, findings, cfg)
+    elif tool == "ports":
+        from .recon import scan_common_ports
+        cfg.scope.require(args.host)
+        ports = scan_common_ports(args.host, banner=getattr(args, "banner", False))
+        for p in ports:
+            b = f"  [{p.get('banner', '')}]" if p.get("banner") else ""
+            print(f"  {p['port']:<6} {p['service']}{b}")
+        print(f"Open ports: {len(ports)}")
+    elif tool == "dns":
+        from .recon import resolve_records, enum_subdomains_robust, brute_subdomains
+        cfg.scope.require(args.domain)
+        records = resolve_records(args.domain)
+        for rtype, vals in records.items():
+            if vals:
+                print(f"{rtype}: {', '.join(vals)}")
+        subs = enum_subdomains_robust(args.domain)
+        print(f"Subdomains ({len(subs)}): {', '.join(subs[:20])}")
+        if getattr(args, "brute", False):
+            print("Brute-forcing common subdomains...")
+            brute = brute_subdomains(args.domain)
+            print(f"Brute found ({len(brute)}): {', '.join(brute)}")
+    elif tool == "endpoints":
+        import urllib.parse
+        if "://" not in args.url:
+            host = args.url
+            url = f"https://{args.url}"
+        else:
+            host = urllib.parse.urlparse(args.url).netloc
+            url = args.url
+        cfg.scope.require(host)
+        from .recon import discover_endpoints
+        found = discover_endpoints(url)
+        for e in found:
+            print(f"  {e['status']:<4} {e['path']}  ({e['size']} bytes)")
+        print(f"Endpoints found: {len(found)}")
+    elif tool == "takeover":
+        from .recon import detect_takeover
+        cfg.scope.require(args.host)
+        findings = detect_takeover(args.host)
+        _print_findings(findings)
+    else:
+        print(f"Unknown recon tool: {tool}")
+        sys.exit(2)
+
+
+def cmd_vuln(args, cfg: Config):
+    tool = args.sub
+    if tool == "cve":
+        from .vuln import lookup_cve, search_cves
+        result = lookup_cve(args.name)
+        if result:
+            print(f"{result['cve']} — {args.name} [{result['severity']}]")
+            print(f"  Affected: {result['affected']}")
+            print(f"  Note: {result['note']}")
+            print(f"  Remediation: {result['remediation']}")
+        else:
+            matches = search_cves(args.name)
+            if matches:
+                print(f"No exact match. Similar CVEs:")
+                for m in matches:
+                    print(f"  {m['name']} ({m['cve']}) [{m['severity']}]")
+            else:
+                print(f"Unknown CVE: {args.name}")
+    elif tool == "config":
+        from .vuln import audit_config
+        findings = _clean_output(audit_config(args.file), args.file, "config-audit")
+        _print_findings(findings)
+        if args.save:
+            _save(args, findings, cfg)
+    elif tool == "tls":
+        from .vuln import scan_tls
+        cfg.scope.require(args.host)
+        findings = _clean_output(scan_tls(args.host, args.port), args.host, "tls-scan")
+        _print_findings(findings)
+        if args.save:
+            _save(args, findings, cfg)
+    elif tool == "secrets":
+        from .vuln import scan_repo
+        findings = _clean_output(scan_repo(args.path), args.path, "secret-scan")
+        _print_findings(findings)
+        if args.save:
+            _save(args, findings, cfg)
+    else:
+        print(f"Unknown vuln tool: {tool}")
+        sys.exit(2)
+
+
+def cmd_pentest(args, cfg: Config):
+    tool = args.sub
+    if tool == "cors":
+        from .pentest import CorsScanner
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        findings = CorsScanner(args.url, host, cfg.scope.targets).scan()
+        _print_findings(findings)
+    elif tool == "verbs":
+        from .pentest import HttpVerbTester
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        findings = HttpVerbTester(args.url, host, cfg.scope.targets).scan()
+        _print_findings(findings)
+    elif tool == "jwt":
+        from .pentest import JwtAuditor
+        findings = JwtAuditor(args.token).audit()
+        _print_findings(findings)
+    elif tool == "redir":
+        from .pentest import OpenRedirectProber
+        payloads = OpenRedirectProber().payloads()
+        for k, v in payloads.items():
+            print(f"  {k}: {v}")
+        print("Inert payload strings — apply manually to authorized targets.")
+    elif tool == "ssrf":
+        from .pentest import SsrfProber
+        if args.url:
+            import urllib.parse
+            host = urllib.parse.urlparse(args.url).netloc or args.url
+            cfg.scope.require(host)
+            hits = SsrfProber.find_candidate_params(args.url)
+            if hits:
+                print("SSRF-prone parameters found:")
+                for h in hits:
+                    print(f"  ?{h['param']}={h['value']}")
+            else:
+                print("No SSRF-prone parameters detected in the query string.")
+        print("\nSSRF payload candidates (inert, manual review):")
+        for k, v in SsrfProber().payloads().items():
+            print(f"  {k}: {v}")
+    elif tool == "ratelimit":
+        from .pentest import RateLimitTester
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        result = RateLimitTester(args.url, host, cfg.scope.targets).test()
+        _print_findings(result["findings"])
+        print(f"Statuses observed: {result['statuses']}")
+    elif tool == "idor":
+        from .pentest import IdorGuide
+        guide = IdorGuide(getattr(args, "base_id", "1000"))
+        print(guide.guidance())
+        print(f"\nCandidate IDs: {', '.join(guide.adjacent_ids())}")
+        if getattr(args, "url", None):
+            print("Candidate URLs (manual review only):")
+            for u in guide.candidate_urls(args.url):
+                print(f"  {u}")
+    elif tool == "hdrinj":
+        from .pentest import HeaderInjectionTester
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        tester = HeaderInjectionTester(args.url, host, cfg.scope.targets)
+        print("CRLF payloads (inert):")
+        for p in tester.payloads():
+            print(f"  {p}")
+        print("\nProbing header reflection...")
+        _print_findings(tester.probe_reflection())
+    elif tool == "graphql":
+        from .pentest import GraphqlIntrospector
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        endpoint = args.url if args.url.endswith("/graphql") else f"{args.url.rstrip('/')}/graphql"
+        _print_findings(GraphqlIntrospector(endpoint, host, cfg.scope.targets).probe())
+    elif tool == "hosthdr":
+        from .pentest import HostHeaderTester
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        _print_findings(HostHeaderTester(args.url, host, cfg.scope.targets).scan())
+    elif tool == "cachep":
+        from .pentest import CachePoisonTester
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        result = CachePoisonTester(args.url, host, cfg.scope.targets).probe()
+        _print_findings(result["findings"])
+        print(f"Statuses: base={result.get('base_status')} busted={result.get('busted_status')}")
+    elif tool == "backups":
+        from .pentest import BackupFileFinder
+        import urllib.parse
+        host = urllib.parse.urlparse(args.url).netloc or args.url
+        cfg.scope.require(host)
+        findings = BackupFileFinder(args.url, host, cfg.scope.targets).scan()
+        _print_findings(findings)
+        print(f"{len(findings)} backup candidates found.")
+    else:
+        print(f"Unknown pentest tool: {tool}")
+        sys.exit(2)
+
+
+def cmd_compliance(args, cfg: Config):
+    if args.sub == "cis":
+        from .compliance import run_cis_checks
+        findings = _clean_output(run_cis_checks(), "localhost", "cis")
+        _print_findings(findings)
+        if args.save:
+            _save(args, findings, cfg)
+    elif args.sub == "password":
+        from .compliance import check_password_strength
+        r = check_password_strength(args.password)
+        print(f"Score: {r['score']}/9  Strength: {r['strength']}")
+        for issue in r["issues"]:
+            print(f"  ! {issue}")
+    else:
+        print(f"Unknown compliance tool: {args.sub}")
+        sys.exit(2)
+
+
+def cmd_defense(args, cfg: Config):
+    if args.sub == "logs":
+        from .defense import analyze_log_file
+        findings = _clean_output(analyze_log_file(args.file), "<logs>", "log-analyzer")
+        _print_findings(findings)
+        if args.save:
+            _save(args, findings, cfg)
+    elif args.sub == "ioc":
+        from .defense import match_iocs
+        findings = _clean_output(match_iocs(args.text), "<text>", "ioc-matcher")
+        _print_findings(findings)
+    else:
+        print(f"Unknown defense tool: {args.sub}")
+        sys.exit(2)
+
+
+def cmd_report(args, cfg: Config):
+    store = Store(cfg.db_path)
+    findings = store.findings(target=args.target)
+    if not findings:
+        print(f"No findings stored for {args.target}. Run a scan with --save first.")
+        sys.exit(1)
+    if args.format == "csv":
+        from .core.report import export_csv
+        path = f"{cfg.report_dir}/{args.target.replace('/', '_')}-report.csv"
+        write_report(path, export_csv(findings))
+        print(f"CSV report written: {path}")
+        store.close()
+        return
+    if args.format == "json":
+        from .core.report import export_json
+        path = f"{cfg.report_dir}/{args.target.replace('/', '_')}-report.json"
+        write_report(path, export_json(findings))
+        print(f"JSON report written: {path}")
+        store.close()
+        return
+    md = build_markdown_report(
+        args.target, findings,
+        scope_note=cfg.scope.note,
+        engagement=args.engagement,
+    )
+    path = f"{cfg.report_dir}/{args.target.replace('/', '_')}-report.md"
+    p = write_report(path, md)
+    print(f"Report written: {p}")
+    store.close()
+
+
+def cmd_scan(args, cfg: Config):
+    from .core.runner import run_against
+    tools = [t.strip() for t in args.tools.split(",") if t.strip()]
+    try:
+        result = run_against(args.target, tools, cfg)
+    except PermissionError as e:
+        print(f"BLOCKED: {e}")
+        sys.exit(3)
+    print(f"Scan complete: {result['target']} ({', '.join(result['tools'])})")
+    print(f"  Findings saved: {result['findings_saved']}")
+    print(f"  Report: {result['report_path']}")
+
+
+def cmd_schedule(args, cfg: Config):
+    from .core.scheduler import ScanScheduler, make_job
+    from .core.runner import run_against
+    tools = [t.strip() for t in args.tools.split(",") if t.strip()]
+    # Verify scope up-front so a misconfigured target fails fast
+    try:
+        run_against(args.target, tools, cfg)
+    except PermissionError as e:
+        print(f"BLOCKED: {e}")
+        sys.exit(3)
+    job = make_job(args.target, tools, cfg)
+    sched = ScanScheduler(args.interval, job, max_iterations=args.runs)
+    print(f"Scheduling scan of {args.target} every {args.interval}s "
+          f"{'(max ' + str(args.runs) + ' runs)' if args.runs else '(until interrupted)'}...")
+    try:
+        sched.run_forever()
+    except KeyboardInterrupt:
+        print("\nStopped.")
+
+
+def _save(args, findings: list, cfg: Config):
+    store = Store(cfg.db_path)
+    target = getattr(args, "target", None) or "local"
+    for f in findings:
+        store.add_finding(
+            target=target,
+            tool=f.get("tool", "unknown"),
+            severity=f.get("severity", "info"),
+            title=f.get("title", ""),
+            detail=f.get("detail", ""),
+            evidence=f.get("evidence", ""),
+            remediation=f.get("remediation", ""),
+        )
+    store.close()
+    print(f"Saved {len(findings)} findings to {cfg.db_path}")
+
+
+def _print_findings(findings: list):
+    if not findings:
+        print("No findings.")
+        return
+    for f in findings:
+        sev = f.get("severity", "info").upper()
+        print(f"[{sev}] {f.get('title')}")
+        if f.get("detail"):
+            print(f"       {f['detail']}")
+        if f.get("remediation"):
+            print(f"       Fix: {f['remediation']}")
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="redforge", description="Security Operations Platform")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_recon = sub.add_parser("recon", help="Reconnaissance tools")
+    recon_sub = p_recon.add_subparsers(dest="sub", required=True)
+    p_sub = recon_sub.add_parser("subdomains", help="Enumerate subdomains (crt.sh)")
+    p_sub.add_argument("domain")
+    p_sub.add_argument("--resolve", action="store_true")
+    p_hdr = recon_sub.add_parser("headers", help="Scan HTTP security headers")
+    p_hdr.add_argument("url")
+    p_hdr.add_argument("--save", action="store_true")
+    p_hdr.add_argument("--target")
+    p_port = recon_sub.add_parser("ports", help="Scan common ports")
+    p_port.add_argument("host")
+    p_port.add_argument("--banner", action="store_true", help="Grab service banners")
+    p_dns = recon_sub.add_parser("dns", help="Enumerate DNS records + subdomains")
+    p_dns.add_argument("domain")
+    p_dns.add_argument("--brute", action="store_true", help="Brute-force common subdomains")
+    p_ep = recon_sub.add_parser("endpoints", help="Discover common endpoints")
+    p_ep.add_argument("url")
+    p_tk = recon_sub.add_parser("takeover", help="Detect potential subdomain takeover")
+    p_tk.add_argument("host")
+
+    p_vuln = sub.add_parser("vuln", help="Vulnerability assessment")
+    vuln_sub = p_vuln.add_subparsers(dest="sub", required=True)
+    p_cve = vuln_sub.add_parser("cve", help="Look up a CVE")
+    p_cve.add_argument("name")
+    p_cfg = vuln_sub.add_parser("config", help="Audit a config file")
+    p_cfg.add_argument("file")
+    p_cfg.add_argument("--save", action="store_true")
+    p_tls = vuln_sub.add_parser("tls", help="Scan TLS config")
+    p_tls.add_argument("host")
+    p_tls.add_argument("--port", type=int, default=443)
+    p_tls.add_argument("--save", action="store_true")
+    p_sec = vuln_sub.add_parser("secrets", help="Recursively scan a repo for secrets")
+    p_sec.add_argument("path")
+    p_sec.add_argument("--save", action="store_true")
+
+    p_comp = sub.add_parser("compliance", help="Compliance auditing")
+    comp_sub = p_comp.add_subparsers(dest="sub", required=True)
+    p_cis = comp_sub.add_parser("cis", help="Run CIS-style checks")
+    p_cis.add_argument("--save", action="store_true")
+    p_pw = comp_sub.add_parser("password", help="Check password strength")
+    p_pw.add_argument("password")
+
+    p_pt = sub.add_parser("pentest", help="Web attack-surface testing (authorized)")
+    pt_sub = p_pt.add_subparsers(dest="sub", required=True)
+    p_cors = pt_sub.add_parser("cors", help="Scan CORS misconfiguration")
+    p_cors.add_argument("url")
+    p_verbs = pt_sub.add_parser("verbs", help="Test HTTP methods")
+    p_verbs.add_argument("url")
+    p_jwt = pt_sub.add_parser("jwt", help="Audit a JWT token")
+    p_jwt.add_argument("token")
+    p_redir = pt_sub.add_parser("redir", help="Generate open-redirect payloads")
+    p_redir.add_argument("--url", help="Optional target base (informational)")
+    p_ssrf = pt_sub.add_parser("ssrf", help="SSRF payloads + URL param detection")
+    p_ssrf.add_argument("--url", help="Target URL to analyze for SSRF-prone params")
+    p_rl = pt_sub.add_parser("ratelimit", help="Bounded rate-limit assessment")
+    p_rl.add_argument("url")
+    p_idor = pt_sub.add_parser("idor", help="IDOR candidate generation (guidance)")
+    p_idor.add_argument("--url", help="Base API URL for candidate review")
+    p_idor.add_argument("--base-id", default="1000", help="Known object ID")
+    p_hdr = pt_sub.add_parser("hdrinj", help="Header-injection payloads + reflection probe")
+    p_hdr.add_argument("url")
+    p_gql = pt_sub.add_parser("graphql", help="GraphQL introspection check")
+    p_gql.add_argument("url")
+    p_hh = pt_sub.add_parser("hosthdr", help="Host-header / cache-poisoning signals")
+    p_hh.add_argument("url")
+    p_cp = pt_sub.add_parser("cachep", help="Cache-key poisoning probe")
+    p_cp.add_argument("url")
+    p_bk = pt_sub.add_parser("backups", help="Probe for exposed backup files")
+    p_bk.add_argument("url")
+
+    p_def = sub.add_parser("defense", help="Defensive monitoring")
+    def_sub = p_def.add_subparsers(dest="sub", required=True)
+    p_logs = def_sub.add_parser("logs", help="Analyze an access log")
+    p_logs.add_argument("file")
+    p_logs.add_argument("--save", action="store_true")
+    p_ioc = def_sub.add_parser("ioc", help="Match IOCs in text")
+    p_ioc.add_argument("text")
+
+    p_rep = sub.add_parser("report", help="Generate a report")
+    p_rep.add_argument("target")
+    p_rep.add_argument("--engagement", default="")
+    p_rep.add_argument("--format", choices=["md", "csv", "json"], default="md")
+
+    p_scan = sub.add_parser("scan", help="Run a combined scan against a scoped target")
+    p_scan.add_argument("target")
+    p_scan.add_argument("--tools", default="headers,ports,tls",
+                        help="Comma-separated: headers,ports,tls,cis,dns,endpoints,takeover,cors,verbs")
+
+    p_sched = sub.add_parser("schedule", help="Run a scan on an interval")
+    p_sched.add_argument("target")
+    p_sched.add_argument("--tools", default="headers,ports,tls")
+    p_sched.add_argument("--interval", type=int, default=3600, help="Seconds between runs (>=5)")
+    p_sched.add_argument("--runs", type=int, default=None, help="Max runs")
+
+    parser.add_argument("--scope", help="Path to scope.json")
+    parser.add_argument("--db", help="SQLite db path")
+    return parser
+
+
+def main(argv=None):
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    cfg = Config.load(args.scope)
+    if args.db:
+        cfg.db_path = args.db
+
+    if args.command == "recon":
+        cmd_recon(args, cfg)
+    elif args.command == "vuln":
+        cmd_vuln(args, cfg)
+    elif args.command == "compliance":
+        cmd_compliance(args, cfg)
+    elif args.command == "pentest":
+        cmd_pentest(args, cfg)
+    elif args.command == "defense":
+        cmd_defense(args, cfg)
+    elif args.command == "report":
+        cmd_report(args, cfg)
+    elif args.command == "scan":
+        cmd_scan(args, cfg)
+    elif args.command == "schedule":
+        cmd_schedule(args, cfg)
+    else:
+        parser.print_help()
+        sys.exit(2)
+
+
+if __name__ == "__main__":
+    main()

redforge/compliance/__init__.py

@@ -0,0 +1,6 @@
+"""Compliance auditing module."""
+
+from .cis import run_cis_checks
+from .password import check_password_strength
+
+__all__ = ["run_cis_checks", "check_password_strength"]

redforge/compliance/cis.py

@@ -0,0 +1,103 @@
+"""CIS-style benchmark checks for the user's own systems.
+
+Runs a set of read-only configuration and system checks against the local
+host (the operator's own machine/server) to assess baseline hardening against
+common CIS benchmark controls. Read-only — no changes are made.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import stat
+from pathlib import Path
+from typing import List
+
+
+def _check_file_perms(path: str, mode: int) -> bool:
+    try:
+        st = os.stat(path)
+        return (stat.S_IMODE(st.st_mode) & mode) == 0
+    except OSError:
+        return True  # file absent = not a finding
+
+
+def _is_installed(bin: str) -> bool:
+    return shutil.which(bin) is not None
+
+
+def run_cis_checks() -> List[dict]:
+    """Evaluate a battery of CIS-style hardening checks on the local host."""
+    findings = []
+
+    # World-writable sensitive files
+    for p in ["/etc/passwd", "/etc/shadow", "/etc/ssh/sshd_config",
+              os.path.expanduser("~/.ssh/authorized_keys")]:
+        if os.path.exists(p) and _check_file_perms(p, stat.S_IWOTH):
+            findings.append({
+                "tool": "cis",
+                "severity": "medium",
+                "title": f"World-writable file: {p}",
+                "detail": f"{p} is writable by other users.",
+                "remediation": f"chmod 600/644 {p}",
+            })
+
+    # Root login via SSH
+    sshd = "/etc/ssh/sshd_config"
+    if os.path.exists(sshd):
+        try:
+            cfg = Path(sshd).read_text()
+            if "PermitRootLogin yes" in cfg and not cfg.lower().startswith("#"):
+                findings.append({
+                    "tool": "cis",
+                    "severity": "high",
+                    "title": "SSH root login permitted",
+                    "detail": "PermitRootLogin is set to yes.",
+                    "remediation": "Set PermitRootLogin no (or prohibit-password).",
+                })
+        except OSError:
+            pass
+
+    # Firewall present
+    if not (_is_installed("ufw") or _is_installed("firewalld") or _is_installed("iptables")):
+        findings.append({
+            "tool": "cis",
+            "severity": "medium",
+            "title": "No firewall tool detected",
+            "detail": "None of ufw/firewalld/iptables found on PATH.",
+            "remediation": "Enable a host firewall.",
+        })
+
+    # Passwordless sudo (indicative)
+    sudoers = "/etc/sudoers"
+    if os.path.exists(sudoers):
+        try:
+            if "NOPASSWD" in Path(sudoers).read_text():
+                findings.append({
+                    "tool": "cis",
+                    "severity": "medium",
+                    "title": "Passwordless sudo configured",
+                    "detail": "NOPASSWD directive found in sudoers.",
+                    "remediation": "Require password for sudo.",
+                })
+        except OSError:
+            pass
+
+    # Core dump limit
+    if not os.path.exists("/proc/sys/fs/suid_dumpable"):
+        pass  # non-Linux; skip
+    else:
+        try:
+            val = Path("/proc/sys/fs/suid_dumpable").read_text().strip()
+            if val != "0":
+                findings.append({
+                    "tool": "cis",
+                    "severity": "info",
+                    "title": "SUID core dumps enabled",
+                    "detail": f"suid_dumpable = {val}.",
+                    "remediation": "Set fs.suid_dumpable = 0.",
+                })
+        except OSError:
+            pass
+
+    return findings